You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: en/on-call/advanced/reference-variables.mdx
+18-4Lines changed: 18 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -57,16 +57,30 @@ Use `[TPL]` as prefix and `{{}}` to reference variables (can reference both labe
57
57
|`[TPL]{{.EventSeverity}} / Host Down`|`{"EventSeverity": "Warning"}`| Warning / Host Down |
58
58
59
59
<Note>
60
-
`${}` syntax and `{{}}` syntax behave differently when a label is missing: `${}` returns `<no value>`, while `{{}}` returns an empty string.
60
+
`${}` syntax and `{{}}` syntax have two key differences:
61
+
-**Data scope**: `${name}` reads **only** from `Labels` and cannot reference attribute fields; `{{}}` uses the whole `*AlertEvent` as the data source, so you can access every exported attribute as well as `Labels`.
62
+
-**Missing-value behavior**: when a label is missing, `${}` returns `<no value>` while `{{}}` returns an empty string.
61
63
</Note>
62
64
63
65
#### Supported Attributes
64
66
67
+
When you use `{{}}` syntax, the template data object is the alert event (`AlertEvent`) itself. The main fields you can reference are listed below:
|`EventStatus`| string | Event status (Critical / Warning / Info / Ok, where Ok indicates recovery) |
75
+
|`AlertKey`| string | The alert's unique key, used to merge events from the same series into a single alert |
76
+
|`TitleRule`| string | The title-generation rule supplied at report time |
77
+
|`IntegrationType`| string | Integration type (such as `prometheus` or `zabbix.v5`) |
78
+
|`IntegrationName`| string | Integration name |
79
+
|`Labels`| map | Label key-value set; access a specific label with `{{.Labels.xxx}}`|
80
+
81
+
<Tip>
82
+
Besides the title, **the alert description and any label value also support reference variables**: in an alert pipeline, when you use the `Reset Description` (resetDescription) or `Reset Labels` (resetLabels) action, any content prefixed with `[TPL]` goes through the same variable substitution.
Go to **Channels** → **Create Channel**. The wizard has three steps, and **steps 2 and 3 are skippable** — you can fill them in later from the channel details page.
37
+
38
+
### Step 1: Channel information
39
+
36
40
<Steps>
37
-
<Steptitle="Enter Creation Page">
38
-
Go to **Channels** → **Create Channel**
39
-
</Step>
40
41
<Steptitle="Fill in Basic Information">
41
42
Enter **Channel Name**, preferably named after business type or team
When enabled, external personnel can submit incident tickets via a shareable external reporting link without logging in. The system generates a shareable link that you can distribute to external personnel. Disabling external reporting immediately invalidates all previously shared links; re-enabling generates a new link.
66
67
</Step>
67
-
<Steptitle="Complete Creation">
68
-
Click **Next** to complete creation
69
-
</Step>
70
68
</Steps>
71
69
70
+
### Step 2: Configure an escalation rule (skippable)
71
+
72
+
Set up a default escalation rule for the new channel to decide who gets notified and how when an incident fires.
73
+
74
+
-**Notification recipients**: choose from a [schedule](/en/on-call/configuration/schedule), a team, or an individual
75
+
-**Notification template**: required — select an enabled [notification template](/en/on-call/configuration/templates)
76
+
-**Delay window**: 0 – 3600 seconds, default 0; no notification is sent if the incident is auto- or manually closed during the delay window
77
+
-**IM group chat channel** (optional): simultaneously push to Feishu/Lark, Dingtalk, WeCom, Slack, Microsoft Teams, and similar group chats
78
+
79
+
If you click **Skip**, you can add it later under **Channel Details → Escalation Rules**. See [Configure Escalation Rules](/en/on-call/channel/escalation-rule) for details.
80
+
81
+
### Step 3: Ingest alert events (skippable)
82
+
83
+
Select one or more alert integrations (such as Zabbix, Prometheus, Alibaba Cloud Monitor) to attach to the current channel, and the system generates the corresponding Webhook addresses.
84
+
85
+
If you click **Skip**, you can add them later under **Channel Details → Configuration → Integrate Data → Dedicated Integrations**. See [Integrate Alerts](/en/on-call/channel/integrate-data) for details.
86
+
72
87
<Note>
73
-
You can skip [escalation rules](/en/on-call/channel/escalation-rule) or [integration configuration](/en/on-call/channel/integrate-data) during creation and manage them later in the channel.
88
+
If you skip steps 2 and 3, only the channel itself is created; you can add or adjust escalation rules and integrations at any time from the channel details page.
74
89
</Note>
75
90
91
+
## Channel Overview
92
+
93
+
On the channel details page, the **Statistics** module at the top shows 4 cards by default, based on **the last 7 days** with comparison to the previous period:
94
+
95
+
| Card | Meaning |
96
+
| :--- | :--- |
97
+
|**MTTA**| Mean time to acknowledge — average elapsed time from incident trigger to acknowledgment |
98
+
|**MTTR**| Mean time to resolve — average elapsed time from incident trigger to close |
99
+
|**Incidents**| Total number of incidents triggered in the last 7 days |
100
+
|**Alert Groups**| Number of alert groups merged into the same incident via alert grouping in the last 7 days |
101
+
102
+
Statistics cards can be collapsed. Open the **Metric Analysis** page for richer trends and dimension drill-downs.
103
+
76
104
## Configuring Core Capabilities
77
105
78
106
After creating a channel, go to the **Configuration** tab on the details page to complete the following configurations. The Configuration tab uses a sidebar menu organized into functional groups:
@@ -196,6 +224,16 @@ Each channel can be associated with up to 3 links. Create links through the **In
196
224
197
225
- Click the **Star** on channel cards to bookmark frequently used channels
198
226
- Quickly locate target channels through **Team Filter** or **My Favorites**
227
+
- Use the **Sort by** dropdown menu to order the list by the following fields:
228
+
229
+
| Sort key | Description |
230
+
| :--- | :--- |
231
+
|**Creation time**| Sort by channel creation time |
232
+
|**Latest incident time**| Sort by the most recent incident time within the channel |
233
+
|**Custom order**| Use the order you set by drag-and-drop below (applies globally) |
234
+
|**Update time**| Sort by the most recent channel configuration update time |
235
+
|**Channel name**| Sort alphabetically by name |
236
+
199
237
- Use the **Sort** function in the upper right corner to enter sort mode, drag and drop channel cards to adjust display order; the sort order takes effect for all users
200
238
201
239
### Changing Configuration
@@ -209,10 +247,17 @@ Go to Channel Details, then navigate to **Configuration** → **Settings** to mo
| Close with alerts | Automatically close the incident once all associated alerts recover | Contact the Flashduty team to enable on request |
255
+
| Outlier incident detection | Identify and flag unusual new incidents | Professional plan and above |
256
+
| External reporting | When enabled, generates a shareable link for external personnel to submit incident tickets without logging in | Professional plan and above |
257
+
258
+
<Note>
259
+
On the free and standard plans, the **Outlier incident detection** and **External reporting** toggles are hidden; the **Close with alerts** toggle is hidden by default — contact the Flashduty team to enable it.
260
+
</Note>
216
261
217
262
### Disabling and Deleting
218
263
@@ -250,6 +295,10 @@ See [Search and View Incidents](/en/on-call/incident/search-view-incident) for d
250
295
<Accordiontitle="Is incident data still available after deleting a channel?"icon="circle-question">
251
296
No, channel configuration (integrations, escalation rules, etc.) will be permanently deleted and cannot be recovered.
252
297
</Accordion>
298
+
299
+
<Accordiontitle="How many channels can I create on the free plan?"icon="circle-question">
300
+
The free plan supports creating **1** channel only. Once a channel exists, the **Create Channel** button is disabled and prompts you to upgrade. To create more channels, upgrade to the standard plan or above. [Learn about subscription plans](https://flashcat.cloud/flashduty/price/)
An escalation rule contains four core elements. The system matches rules from top to bottom, **stopping after the first successful match**.
21
+
An escalation rule contains six core elements. The system matches rules from top to bottom, **stopping after the first successful match**.
22
22
23
23
You can enable or disable individual escalation rules. Disabled rules are skipped during matching and will not trigger notifications. You can also copy an escalation rule to the current channel or another channel to quickly reuse existing configurations.
24
24
@@ -80,7 +80,25 @@ Determines how users are reached.
80
80
</Tab>
81
81
</Tabs>
82
82
83
-
### 4. Escalation Rules
83
+
### 4. Delay Window
84
+
85
+
Reserve a waiting period before the first notification is sent, to filter out incidents caused by transient flapping.
- During the delay window, if the incident is **auto-closed** or **manually closed**, the system does not send a notification
89
+
90
+
<Tip>
91
+
For easily self-healing monitors (such as transient flaps or brief network timeouts), setting a reasonable delay window can significantly reduce unnecessary interruptions.
92
+
</Tip>
93
+
94
+
### 5. Notification Template
95
+
96
+
Every escalation rule **must** select a notification template, which determines the message format delivered to each channel.
97
+
98
+
- Templates must be created and enabled in advance under [Notification Templates](/en/on-call/configuration/templates)
99
+
- You can pick different templates for different escalation rules to format messages for specific scenarios
100
+
101
+
### 6. Escalation Rules
84
102
85
103
This is the key mechanism for ensuring incident closure. When first-level responders don't respond or complete handling, the system automatically escalates to the next level.
86
104
@@ -103,6 +121,12 @@ The minimum escalation timeout is 1 minute.
103
121
| Primary/Backup Escalation | Primary on-call no response for 10 min → Escalate to backup on-call |
104
122
| Tiered Reporting | Technical staff unresolved for 30 min → Escalate to Tech Lead → Escalate to CTO |
105
123
124
+
**Level management**:
125
+
126
+
-**Default first level**: when you create a rule, the first level is generated automatically, with a default **30-minute timeout** before escalation, **no repeated notifications**, and notification methods that **follow personal preferences**
127
+
-**Add or remove levels**: you can add or remove levels freely; a rule must keep at least 1 level
128
+
-**Reorder**: you can move a level up or down, or insert a new level between any two existing levels
|**Aggregation Window**| Optional toggle. When disabled, new alerts continue merging into the incident until the incident is closed. When enabled, alerts within the window are merged; alerts arriving after the window expires are grouped into a new incident |
105
105
|**Window Timing Start**| Only configurable when the aggregation window is enabled. **Incident trigger** (default): Fixed timer starts from incident creation, stops grouping when the window duration is reached. **Alert merges into incident**: Timer resets each time a new alert merges in, the window recalculates from the last merge |
106
-
|**Window Duration**| Only configurable when the aggregation window is enabled. Set the duration of the aggregation window |
106
+
|**Window Duration**| Only configurable when the aggregation window is enabled. Set the duration of the aggregation window, minimum 1 minute. Rule-based grouping and intelligent grouping share the same cap: 24 hours by default, extendable to 30 days on request (contact the Flashduty team to enable)|
107
107
|**Alert Storm Warning**| When merged alert count reaches a configured threshold, the system records an alert storm event in the incident timeline and triggers a warning notification, prompting urgent handling. You can configure up to 5 thresholds, each ranging from 2 to 10,000 |
108
108
|**Strict Grouping**| When enabled, empty label values are treated as different; when disabled, empty values are treated as the same (not supported for intelligent grouping) |
109
109
@@ -146,6 +146,16 @@ Flashduty On-call provides two grouping modes:
146
146
</Tab>
147
147
</Tabs>
148
148
149
+
### Configuration Limits
150
+
151
+
To protect grouping performance and stability, the following fields have hard backend caps:
152
+
153
+
| Grouping mode | Limit | Cap | Description |
154
+
| :--- | :--- | :--- | :--- |
155
+
|**Rule-based grouping**| Grouping dimensions (equals) | ≤ 5 per group | Number of dimensions per rule in both unified control and fine-grained control |
156
+
|**Rule-based grouping**| Fine-grained branches (cases) | ≤ 100 | Total condition branches you can configure under fine-grained control |
157
+
|**Intelligent grouping**| Fields used for similarity calculation (i_keys) | ≤ 10 | Default 4: `title`, `description`, `labels.service`, `labels.resource`|
158
+
149
159
### Grouping Effect
150
160
151
161
After setting grouping by **Alert Check Item**, 5 alert notifications are grouped into 1 incident:
@@ -196,7 +206,7 @@ Go to Channel Details → Noise Reduction → **Flapping Detection**:
196
206
| :--- | :--- | :--- | :--- |
197
207
|**State changes** (max_changes) | Number of alert state changes within the observation window to trigger flapping detection | 4 | 2–100 |
198
208
|**Observation window** (in_mins) | Time window for counting state changes | 60 minutes | 1–1440 minutes |
199
-
|**Mute duration** (mute_mins) | Duration to mute notifications after flapping is detected (only applies in "Alert Then Silence" mode) | 120 minutes |0–1440 minutes |
209
+
|**Mute duration** (mute_mins) | Duration to mute notifications after flapping is detected (only applies in "Alert Then Silence" mode) | 120 minutes |30–1440 minutes |
200
210
201
211
<Tip>
202
212
"Same incident" refers to incidents with the same Alert Key, typically using the alert ID pushed from the upstream system as a unique identifier.
@@ -259,7 +269,7 @@ Quickly create temporary silence rules based on existing incidents.
259
269
260
270
- Rule name defaults to "Quick Silence - #short-ID", with the incident title included in the description
261
271
- Effective scope is the incident's channel (cannot be changed)
262
-
- Default effective for 24 hours, automatically deleted after expiration
272
+
- Default effective for 1 hour; you can choose from **30 minutes / 1 hour / 12 hours / 1 day / 1 week / 2 weeks**, and the rule is automatically deleted after expiration
263
273
- Conditions default to severity and filtered label matching (automatically excluding numeric, overly long, and special labels)
264
274
265
275
<Framecaption="Quick Silence Configuration">
@@ -291,7 +301,7 @@ When a root cause alert exists, automatically inhibit related secondary alerts.
291
301
292
302
### Inhibit Conditions
293
303
294
-
When a new alert meets conditions, and there's an **active incident** (not closed) meeting conditions within 10 minutes, and both share equal items, the new alert is inhibited.
304
+
When a new alert meets the conditions and there is a matching **active alert** (not acknowledged and not recovered) within the last 10 minutes, and both share equal items, the new alert is inhibited.
295
305
296
306
| Configuration | Description |
297
307
| :--------- | :------------------------------ |
@@ -331,8 +341,7 @@ When a new alert meets conditions, and there's an **active incident** (not close
331
341
Up to 5000, mainly to ensure console rendering performance. Due to backend concurrent processing, actual count may slightly exceed this limit.
332
342
</Accordion>
333
343
<Accordiontitle="What's the maximum number of events a single alert can be associated with?"icon="circle-question">
334
-
-**Rule-based Grouping**: No limit, default maximum grouping window is 24 hours. After 24 hours from alert trigger, new events create new incidents
335
-
-**Intelligent Grouping**: No limit, default maximum grouping window is 24 hours, with certain subscription plans supporting extension up to 30 days. After exceeding the window, new events create new incidents
344
+
-**Rule-based grouping / Intelligent grouping**: No limit, default maximum aggregation window is 24 hours; rule-based and intelligent grouping share the same cap and can be extended to 30 days on request (contact the Flashduty team to enable). After exceeding the window, new events create new incidents
336
345
- If the aggregation window is disabled, alerts continue merging into the existing incident until the incident is closed, with no time limit
Copy file name to clipboardExpand all lines: en/on-call/configuration/custom-fields.mdx
+10-6Lines changed: 10 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -64,11 +64,11 @@ Go to Console **Incident Management** → **Custom Fields**
64
64
<Steptitle="Create Field">
65
65
Click **Create Custom Field**, enter the following information:
66
66
67
-
| Configuration | Description |
68
-
| :--- | :--- |
69
-
|**Field Name**| Identifies the field in API, cannot be modified after creation |
70
-
|**Display Name**| Shown on incident details page, can be modified after creation |
71
-
|**Field Description**| Helps incident handlers understand and use this field |
67
+
| Configuration | Description | Constraints |
68
+
| :--- | :--- | :--- |
69
+
|**Field Name**| Identifies the field in API, cannot be modified after creation | 1-40 characters; letters, digits, and underscores only, and cannot start with a digit (regex: `^[a-zA-Z_][a-zA-Z0-9_]{0,39}$`) |
70
+
|**Display Name**| Shown on incident details page, can be modified after creation | 1-40 characters |
71
+
|**Field Description**| Helps incident handlers understand and use this field | Up to 200 characters, optional |
72
72
</Step>
73
73
<Steptitle="Select Field Type">
74
74
| Type | Description |
@@ -79,7 +79,11 @@ Click **Create Custom Field**, enter the following information:
79
79
|**Checkbox**| Checkbox toggle |
80
80
</Step>
81
81
<Steptitle="Complete Creation">
82
-
Set options and default values as needed, click **Submit** to finish
82
+
Set options and default values as needed, click **Submit** to finish.
83
+
84
+
<Note>
85
+
For single-select and multi-select fields, the **default value** must be one of the options currently defined on the field. If you delete or modify an option, update the default value accordingly — otherwise the field cannot be saved.
0 commit comments